Exam SC-300 topic 4 question 46 discussion

Correct User1 -> User2, User3, User4, User5 User4 -> User1, User2 & User3 Can reset passwords for non-administrators and Password Administrators https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#who-can-reset-passwords

1) User2, User3, User4, User5 User1 has the Role Scope set to ORGANIZATION. This means they have the ability to change passwords for all users...even if the users are in an AU. 2) User3 ONLY To prevent an elevation of privilege, an administrative unit-scoped administrator can't reset the password of a user who's assigned to a role with an organization-wide scope.

- Password Administrator- Privileged role that can reset passwords for non-administrators and Password Administrators. - Global reader is a privileged role https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference user1->user3,user4,user5 user4->user3 only

The answer options are not correct here. I tried simplifying like this Password administrator cannot change passwords for privileged roles. Global reader is a priviledged role in azure built-in roles. so no matter whether global reader belongs to organization or an AU, his password cannot be changed. which means neither User 1 nor User 4 can reset User 2's password. Coming to User 1, since his scope is for the organization, which means the AU within which means that User 1 can reset passwords for User 1, 3,4,5 and for User 4 the scope is only AU1, which means only User 1 & User 3. User 2 is a privileged role so cannot be touched by a password administrator. Link/ s i referred are as below. https://docs.azure.cn/en-us/entra/identity/role-based-access-control/privileged-roles-permissions?tabs=admin-center#which-roles-and-permissions-are-privileged https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#global-reader

Not sure why you guys are saying User 4 can't reset user 2, and only 3.. it's User 2 and 3 | AU1 Scoped Password Administrator: An AU1 scoped Password Administrator can reset the passwords for users within AU1, including other administrators with roles scoped to AU1. This includes resetting passwords for other AU1 scoped Password Administrators.

User1 -> User1,User2,User3,User4 User4-> ONLY USER3 Password administrators can reset passwords for non-administrators within the assigned administrative unit only. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-assign-roles#roles-that-can-be-assigned-with-administrative-unit-scope

Correct

Correct. Organization - everyone under the org AU1 - only those belonging to the said AU

Correct User1 -> User2, User3, User4, User5 User4 -> User1, User2 & User3